summaryrefslogtreecommitdiff
path: root/sbin/pfctl
AgeCommit message (Collapse)Author
2002-11-09SEE ALSO reordering and corrections.Federico G. Schwindt
2002-11-08init buf to NULL just in case...Henning Brauer
there isn't a single codepath where it can remain uninitialized, but this might prevent a stupid bug if we change something later
2002-11-07move the ifa_exists block a bit up in host()Henning Brauer
inspired by mpech@ pointing out a missing free(buf). so handle the it-is-an-interface case where we don't need the buf before allocating memory.
2002-11-04welcome to CIDR world, pfctl!Henning Brauer
use inet_net_pton to parse IP adresses. stuff like block in from 10/8 to any works now. some input camield@ and dhartmei@ ok dhartmei@, camield@, mcbride@
2002-11-02%i -> %d, matches the style of existing code, from millert@Daniel Hartmeier
2002-11-02printf int with %i, not %u. from pilot@monkey.org.Daniel Hartmeier
2002-10-30simplifyHenning Brauer
2002-10-30fix interface expansion. since the reversed list expansion code wasHenning Brauer
committed this was broken, only the first IP address was returned. pointed out by danh@, who sent an excellent bug report. ok dhartmei@
2002-10-29introduceHenning Brauer
set require-order [yes|no] default is yes. with set to "no", it isn't required to have the rules in order (options, scrub, nat, filter) any more, though of course NATing still happens before filtering and so on, so one has to take care. ok camield@ mcbride@ dhartmei@ idea discussed with a whole lotta more people and basically ok for everyone ;-)
2002-10-27remove the "flags X" syntax.Henning Brauer
noone who wrote "flags S" meant that, but actually something like "flags S/SA". with "flags S" changing its actual meaning as more flags got supported, things got worse. ok dhartmei@, pb@
2002-10-25- more sa_family_tCamiel Dobbelaar
- move unmask code to correct file - whitespace ok mcbride@ dhartmei@
2002-10-22%ul -> %luMike Pechkin
dhartmei@ ok
2002-10-22More conversion of "int af" and "u_int8_t af" declarations and functionRyan Thomas McBride
arguments to the more correct and descriptive "sa_family_t af" ok dhartmei@ henning@
2002-10-22Rename ipmask to set_ipmask and add some functionality: the netmaskCamiel Dobbelaar
is applied immediately to the address. This way, the parsed rules output shows exactly which bits of an address are significant for a match and errors due to wrong netmasks can be spotted more easily. Example: $ pfctl -nvf - pass in on lo0 from 172.17.0.0/12 to any @0 pass in on lo0 inet from 172.16.0.0/12 to any idea refined by dhartmei@ ok frantzen@ henning@
2002-10-17These checks are also made in nat_consistent() and rdr_consistent().Ryan Thomas McBride
ok dhartmei@ henning@
2002-10-17- accept all protocols that are specified by number if they are inCamiel Dobbelaar
the valid range (also when they're not listed in /etc/protocols) - explicitly disallow protocol number 0, because it has special meaning to pf ok dhartmei@ henning@
2002-10-16Fix and improve binat mask comparison.Mike Pechkin
dhartmei@, henning@ ok
2002-10-14Allow one to specify a netblock in a binat rule:Henning Brauer
binat on fxp0 from 192.168.0.32/27 to any -> 10.0.7.128/27 Both the network mask on the source and redirect addresses MUST be the same, and it works by essentially combining the network section of the redirect address with the host section of the source address. from ryan ok dhartmei@
2002-10-11When a macro cannot be expanded because it is not defined, say so. Also warnCamiel Dobbelaar
about unused macros. ok dhartmei@ henning@
2002-10-11In lgetc(), compress strings of whitespace to a single space. This makesCamiel Dobbelaar
macros come out right in verbose mode and is less functional overhead. Also err on whitespace after a backslash. That type of error is hard to find otherwise. ok dhartmei@ henning@
2002-10-08 remove <0 checks on unsigned numbers.Vincent Labrecque
ok henning@
2002-10-07-Wsign-compare cleanDaniel Hartmeier
2002-10-07Two cases of const-correctness and make one global local.Daniel Hartmeier
2002-10-07set block-policy [drop|return]Henning Brauer
drop is default, same behaviour as before support block drop to override a return policy
2002-10-07support a generic returnHenning Brauer
block return in|out ... acts like return-rst on tcp, like return-icmp on udp and like an ordinary block on anything else ok dhartmei@
2002-10-07make return-icmp work for rules covering both v4 and v6Henning Brauer
-new field "return_icmp6" in pf_rule -parser accepts block return-icmp(ipv4-icmpcode, ipv6-icmpcode) ok and some input dhartmei@
2002-10-07use a new rule_flag PFRULE_RETURNICMP to decide wether to return-icmp or notHenning Brauer
instead of just testing return_icmp > 0 ok dhartmei@
2002-10-07Add 'reply-to' to filter rules, similar to route-to, but applying toDaniel Hartmeier
replies (packets that flow in the opposite direction of the packet that created state), used for symmetric routing enforcement. Document how route-to and reply-to work in context of stateful filtering.
2002-10-06Move CHECK_ROOT into LOOP_THROUGH, gets rid of one macro and savesDaniel Hartmeier
several lines, no functional difference. From Camiel Dobbelaar.
2002-10-05Expand {} lists from left to right, so 'pass in from { a, b } to any'Daniel Hartmeier
becomes '@0 pass in from a to any @1 pass in from b to any' instead of the other way around. Patch from Camiel Dobbelaar.
2002-10-05Allow filtering based on IP header's tos field.Daniel Hartmeier
2002-09-22little KNF: return(something) -> return (something)Henning Brauer
2002-09-22fix linenumber counting in findeol, and simplify by ignoring the \ case,Henning Brauer
that's already handled earlier. fast-forward on errnous lines partitially from camield@, parts result of a discussion with Mike ok frantzen@ dhartmei@
2002-09-22antispoof, take 2.Henning Brauer
also block incoming packets with our own IP as src. discussion & help frantzen ok ho@ dhartmei@ frantzen@
2002-09-18fix Xr refs; frisco@blackant.netTheo de Raadt
2002-09-17easier "self" implementation.Henning Brauer
no functional changes ok pb@
2002-09-15set a netmask in the dynaddr caseHenning Brauer
noticed by <han@mijncomputer.nl> ok pb@
2002-09-14oooooooopsieHenning Brauer
2002-09-14bit more clue in rdr/nat rules wrt address family examinationHenning Brauer
don't take the af from host_node structs based on interface lookups, most interfaces will have both IPv4 and IPv6 addresses. Most rdr/nat rules will at least have one IP address specified from whoch we take the af for the whole rule. The rare exceptional cases require the user to specify the af. ok frantzen@
2002-09-12check for calloc() failure; ho@Henning Brauer
2002-09-12antispoof [log] [quick] for [interface|interface_list] [af]Henning Brauer
e. g. antispoof log quick for { dc0, dc1 } inet docs & regress coming ok pb@, frantzen@, deraadt@ also looked over kjell@, markus@, itojun@, dhartmei@ IPv6 help itojun@ finally, a long story finds its happy end here.
2002-09-12rework netmask handling:Henning Brauer
-don't set netmask in host token handler -clear netmask in ipmask() proper before setting it -in ifa_load(), also store interface's netmask and broadcast address -allow ifa_lookup() to return either the interface's IP address(es), network(s) or broadcast address(es) - not used anywhere yet. This implies that ifa_lookup() also returns the netmask now. -host() returns netmasks, too ok pb@, frantzen@, deraadt@ also looked over kjell@, markus@, itojun@, dhartmei@
2002-09-08be more clueful wrt address family in nat/rdr rules.Henning Brauer
behaviour noticed by Paul de Weerd, thanks! ok dhartmei@
2002-09-02Fix parsing of port ranges in translation rules (port a:b -> port c:d).Daniel Hartmeier
ok henning@
2002-09-02Make sure the interface specified with route-to/dup-to/fastroute existsDaniel Hartmeier
and null-terminate the interface name. Found by Michael Wallis. ok henning@
2002-08-20Increase lineno on newlines inside multi-line macro definitions, otherwiseDaniel Hartmeier
errors on subsequent lines are reported with wrong line numbers. From Paul B. Henson.
2002-08-16kill duplicated check for '(' and ')' in allowed_in_stringHenning Brauer
2002-08-12Catch null pointer deref (segfault), from wilfried@Daniel Hartmeier
2002-08-06missing free(), mpech@Henning Brauer
ok pb@
2002-08-06check fo strdup() allocation errorsHenning Brauer
pointed out by mpech@ ok pb@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-08 08:35:54 +0000